powershell - Update AzureAD/O365 UPN via Graph -

i attempting update upn of azure ad user (loaded azure ad connect) in federated domain via ms graph leveraging .net adal library in powershell. reasonably have configured correctly within azure , in ps, because if issue command update usagelocation attribute, works (clipped brevity):

$upn="user@mytenant.edu" $body=@{usagelocation="jp"} | convertto-json $result=invoke-restmethod -method patch -uri "https://graph.microsoft.com/v1.0/users/${upn}" -headers @{authorization=$authenticationresult.createauthorizationheader()} -contenttype "application/json" -body $body $user=invoke-restmethod -method -uri "https://graph.microsoft.com/v1.0/users/${upn}?`$select=usagelocation" -headers @{authorization=$authenticationresult.createauthorizationheader()} -contenttype "application/json" $user.usagelocation  jp 

but, if attempt update upn non-federated domain (so not run afoul of issue described in http://blogs.perficient.com/microsoft/2013/03/changing-upn-for-office-365-account-between-two-sso-domains/), internal server error (500):

$upn="user@mytenant.edu" $body=@{userprincipalname="user@tenant.onmicrosoft.com"} | convertto-json $result=invoke-restmethod -method patch -uri "https://graph.microsoft.com/v1.0/users/${upn}" -headers @{authorization=$authenticationresult.createauthorizationheader()} -contenttype "application/json" -body $body  invoke-restmethod : remote server returned error: (500) internal server error. 

i've tried many different variations, including retrieving azure ad guid , using rather upn in patch command , using older azure ad graph (which returns same 500 error). can make change using o365 powershell commands:

set-msoluserprincipalname -userprincipalname $upn -newuserprincipalname $newupn 

but can't seem make work via ms graph. docs graph imply upn can updated other attributes (c.v. http://graph.microsoft.io/en-us/docs/api-reference/v1.0/api/user_update, example). i'm wondering though if because upn key, maybe makes update not work? don't think permission issue, throw "insufficient privileges complete operation." not i'm seeing.

thank you!

update1: here's can fish out of error object re-attempt morning :

{   "error": {     "code": "service_internalservererror",     "message": "encountered internal server error.",     "innererror": {       "request-id": "cbb08d3c-1143-4d0b-8722-5230b00bd00f",       "date": "2016-02-15t16:48:15"     }   } } 

i took @ trace, , file bug on our side 500 error (we can better here). based on trace, if updating user renaming them out of federated domain cloud managed domain, must provide/set password part of request (using passwordprofile complex type). why request failing according logs. please let know if solves issue.